The Senior: Red Team Consultant is a highly skilled cybersecurity professional who specializes in advanced penetration testing and adversarial simulations. They often serve as a lead or senior member of a red team, providing technical expertise, mentorship, and strategic guidance to the team.
Responsibilities:
Perform Web Application, Mobile Application, Wireless Networks, and Infrastructure Penetration Tests both onsite and remotely as needed.
Conduct secure code reviews, identifying vulnerabilities in source code across various programming languages and back-end technologies.
Participate in discussions with clients to understand their environment and applications, define the scope and Rules of Engagement, and organize test schedules.
Create detailed technical reports describing how vulnerabilities were identified, how they were exploited, and how they should be remediated.
Produce executive summary reports that communicate the business risks of identified vulnerabilities and the importance of prioritizing remediation.
Assist customers by answering questions and providing guidance about remediation strategies.
Mentor junior Penetration Testers during and outside of assessments.
Participate in internal research projects to explore emerging security threats, tools, and techniques.
Contribute to the development of new penetration testing services to expand the organization's capabilities and offerings.
Qualifications, Experience and Skills:
5+ years of experience in the offensive security field.
Experience performing penetration tests against Web Applications, Mobile Applications, Desktop Applications, wireless networks, and Infrastructure within Active Directory-based environments.
Experience in secure code review, identifying vulnerabilities in source code, and providing recommendations for secure coding practices.
Experience briefing engagement results to different customer levels.
Proficiency in programming languages such as C++, C, and C#.
Experience with various scripting languages, such as Bash, Python, and PowerShell.
Knowledge of back-end web technologies, including but not limited to server-side programming languages (e.g., Java, .NET, PHP, Node.js) and database systems (e.g., MySQL, MSSQL, PostgreSQL).
Knowledge of AV/EDR evasion techniques is preferred.
One or more recognized industry certifications, such as OSCP, OSWE, OSEP, OSED, GPEN, GWAPT, and GXPN.
Excellent written and verbal communication skills.
